---
title: Potential ConnectWise ScreenConnect Authentication Bypass
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects potential exploitation of CVE-2024-1708 involving suspicious path traversal or authentication anomalies in ScreenConnect logs.
status: experimental
date: 2026/07/31
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
tags:
    - cve.2024.1708
    - attack.initial_access
    - attack.t1190
logsource:
    category: web
detection:
    selection:
        cs-uri-query|contains:
            - '/SetupInfo'
            - '../'
        c-uri|contains: 'ScreenConnect'
    condition: selection
falsepositives:
    - Legitimate administrative access using legacy clients
level: high
---
title: Suspicious Check Point VPN IKEv1 Packet Anomalies
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
description: Detects indicators of CVE-2026-50751 exploitation via anomalous IKEv1 key exchange patterns on VPN gateways.
status: experimental
date: 2026/07/31
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
tags:
    - cve.2026.50751
    - attack.initial_access
    - attack.t1190
logsource:
    product: firewall
detection:
    selection:
    - dst_port: 500
    - protocol: 'UDP'
    - vpn_message|contains: 'IKE_SA_INIT'
    filter:
        src_ip:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selection and not filter
falsepositives:
    - Legitimate remote employee VPN connections
level: high
---
title: Ransomware Pattern - Massive File Deletion VSS Stop
description: Detects activity consistent with DRAGONFORCE encryption preparation including stopping VSS service and deleting shadow copies.
status: experimental
date: 2026/07/31
author: Security Arsenal Research
tags:
    - attack.impact
    - attack.t1490
logsource:
    product: windows
    service: security
detection:
    selection_vss:
        EventID: 7036
        ServiceName: 'VSS'
        Message: 'stopped'
    selection_shadow:
        EventID: 1
        Channel: 'Microsoft-Windows-Sysmon/Operational'
        CommandLine|contains: 'delete shadowcopy'
    condition: 1 of selection*
falsepositives:
    - Legitimate system admin backups
level: critical

// Hunt for lateral movement and staging associated with DRAGONFORCE TTPs
// Looks for PsExec/WMI execution and unusual SMB file writes
let TimeFrame = 1h;
DeviceProcessEvents  
| where Timestamp > ago(TimeFrame)
| where ProcessName in~ ('psexec.exe', 'psexec64.exe', 'wmic.exe') 
   or ProcessVersionInfoOriginalFileName in~ ('psexec.exe', 'wmic.exe')
| extend HostName = DeviceName
| project Timestamp, HostName, AccountName, ProcessName, InitiatingProcessFileName, CommandLine
| join (
    DeviceFileEvents
    | where Timestamp > ago(TimeFrame)
    | where ActionType == 'FileCreated'
    | where FileName endswith '.encrypted' or FolderPath contains 'STAGING' 
    | project Timestamp, HostName=DeviceName, FileName, FolderPath, SHA256
) on HostName, Timestamp
| distinct Timestamp, HostName, AccountName, ProcessName, FileName, CommandLine

<#
.SYNOPSIS
    DRAGONFORCE Rapid Response Hardening Script
.DESCRIPTION
    Checks for indicators of DRAGONFORCE compromise (Exposed RDP, VSS manipulation) 
    and applies immediate hardening based on associated CVEs.
#>

Write-Host "[+] Starting DRAGONFORCE Rapid Response Check..." -ForegroundColor Cyan

# 1. Check for Recent Volume Shadow Copy Deletion (Pre-Encryption)
Write-Host "[*] Checking for VSS manipulation in the last 24h..." -ForegroundColor Yellow
try {
    $vssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='VSS'; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
    if ($vssEvents) {
        Write-Host "[!] ALERT: Recent VSS activity detected. Review these events:" -ForegroundColor Red
        $vssEvents | Select-Object TimeCreated, Id, Message | Format-Table -Wrap
    } else {
        Write-Host "[OK] No recent VSS anomalies found." -ForegroundColor Green
    }
} catch { Write-Host "[INFO] No VSS logs found (common on non-servers)." }

# 2. Audit Scheduled Tasks (Common Persistence)
Write-Host "[*] Enumerating Scheduled Tasks created in the last 7 days..." -ForegroundColor Yellow
$schTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($schTasks) {
    Write-Host "[!] ALERT: New Scheduled Tasks detected:" -ForegroundColor Red
    $schTasks | Select-Object TaskName, Date, Author, Action | Format-List
} else {
    Write-Host "[OK] No new suspicious scheduled tasks." -ForegroundColor Green
}

# 3. Hardening: Check for RDP Exposure (If applicable)
Write-Host "[*] Checking RDP Status..." -ForegroundColor Yellow
$rdpProperty = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
if ($rdpProperty.fDenyTSConnections -eq 0) {
    Write-Host "[!] WARNING: RDP is ENABLED. Consider disabling or enforcing VPN/NLA." -ForegroundColor Red
} else {
    Write-Host "[OK] RDP is disabled." -ForegroundColor Green
}

Write-Host "[+] Scan Complete. If anomalies found, isolate host immediately." -ForegroundColor Cyan


---

# Incident Response Priorities

**T-Minus Detection Checklist:**
1.  **Hunt for Web Shells:** Check web roots (IIS/Apache) for recently modified files containing base64 or obfuscated code (linked to CVE-2026-48027).
2.  **VPN/Firewall Logs:** Immediate audit of Check Point (CVE-2026-50751) and Cisco FMC (CVE-2026-20131) logs for unusual authentication failures or administrator logins from foreign IPs (TH/GB correlation).
3.  **RMM Tool Audit:** Review ConnectWise ScreenConnect logs for "SetupInfo" access patterns linked to non-admin accounts.

**Critical Assets for Exfiltration:**
*   **Legal:** Client case files, M&A agreements, trust documents.
*   **Manufacturing:** CAD drawings, proprietary formulas, supply chain vendor lists.
*   **Hospitality:** Guest PII (passports, credit cards), booking databases.

**Containment Actions:**
1.  **Isolate:** Segment suspected machines from the network immediately; do not power down (preserve RAM for forensics).
2.  **Reset Credentials:** Force reset of all privileged accounts (Domain Admin, Service Accounts) and VPN credentials.
3.  **Block IP Indicators:** If threat intelligence suggests specific C2 IPs, block at the perimeter firewall.

---

# Hardening Recommendations

**Immediate (24 Hours):**
*   **Patch CVE-2024-1708:** Apply the ConnectWise ScreenConnect patch immediately or restrict access to trusted IPs.
*   **Disable IKEv1:** On Check Point Security Gateways, disable IKEv1 and enforce IKEv2 to mitigate CVE-2026-50751.
*   **MFA Enforcement:** Enforce strict MFA on all VPN and RMM access points.

**Short-term (2 Weeks):**
*   **Network Segmentation:** Ensure critical intellectual property servers are not directly accessible from the DMZ or VPN subnets.
*   **EDR Deployment:** Ensure EDR coverage is 100% across all endpoints, specifically focusing on administrative jump servers.
*   **VSS Hardening:** Implement strict permissions on the `VSSAdmin` utility to prevent non-admins from deleting shadow copies.

---